fix: repair the SMS 2FA flow (active 412 challenge and -22979/-22981 throttling) - #9
Open
BK0STAR wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes edge cases in the Apple SMS 2FA flow by correctly handling “active SMS challenge” (HTTP 412) and SMS throttling service errors (-22979/-22981), while avoiding a hard-coded trusted phone number ID by requiring selection from the retrieved trusted numbers.
Changes:
- Add strict classification for SMS send responses to treat HTTP 412 as an already-active SMS challenge when the response matches expected
hsa2+ selected number + unlocked 6-digit code constraints. - Preserve and route throttling service errors
-22979/-22981to SMS code entry (NeedsSMS2FAVerification(id)) without losing the selected number or triggering a resend. - Add contract-style unit tests for SMS send response classification and run
cargo test -p isideloadin CI.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| isideload/src/auth/apple_account.rs | Improves SMS 2FA send error handling/classification, preserves selected phone number across throttling, adds tests, and removes hard-coded trusted number selection. |
| .github/workflows/build.yml | Adds CI coverage for isideload tests to catch regressions in the auth flow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
324
to
326
| info!( | ||
| "The most recently attempted 2FA Method failed, please try a different method." | ||
| ); |
…throttling) - Classify a 412 response carrying an active SMS challenge instead of aborting, so the user can enter the code that was already sent. - Map -22979/-22981 (throttling) to NeedsSMS2FAVerification(id), keeping the selected number and last_error, without triggering another send. - Keep -28248 mapped to NeedsUnknown2FA (choose another method). - Stop hardcoding phone number ID 1: load the trusted phone numbers. - Add the sms_send_response_tests contract tests and a cargo test CI step.
BK0STAR
force-pushed
the
fix/sms-2fa-active-challenge
branch
from
August 10, 2026 18:07
e0a5f07 to
f560857
Compare
BK0STAR
changed the title
BK0STAR
added a commit
to BK0STAR/iloader
that referenced
this pull request
Aug 10, 2026
The 2FA bridge only handled SubmitCode; isideload also requires SendSms, SendToDevices, ResendCode and Abort. - Tauri backend: a typed async request_two_factor_response exchanging TwoFactorCallbackParams/Response over the 2fa-required/2fa-response events, with a timeout and a clean Abort path. - UI: trusted-method and trusted-number pickers, resend code, send to devices, last_error display, and associated styles. - EN/FR locales for the new strings. - Parsing tests for all TwoFactorCallbackResponse variants. Depends on nab138/isideload#9 (the isideload-side 2FA logic).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The SMS 2FA flow fails (reported in nab138/iloader#319):
send_sms_2fatreats every non-2xx response withoutserviceErrorsas fatal. Two cases were mishandled:mode: sms, trusted number, no lockout flags), but the request aborted instead of moving on to code entry.-22979/-22981("Too many verification codes…") — routed toNeedsUnknown2FA, which loses the selected phone number and forbidsSubmitCode/ResendCode. Yet-22979explicitly says "Enter the last code you received": a code was already sent and stays valid.In addition, the phone number ID was hardcoded to
1instead of loading the trusted phone numbers.Fix
classify_sms_send_response): checksmode,authenticationType: hsa2, matching phone-number id, code length 6, and no lockout flags →SmsSendOutcome::ActiveChallenge(proceeds to verification).-22979/-22981→NeedsSMS2FAVerification(id)withlast_error, keeping the selected number and without triggering another send.-28248→ kept asNeedsUnknown2FA(choose another method).1.Tests
sms_send_response_tests(10 contract tests: active challenge, wrong number, malformed response, lockout flags, preserved service errors).cargo test -p isideloadto CI.cargo test -p isideload: 10/10 passing.Real-world verification
Tested end-to-end with iloader (v2.3.1 + this isideload): at
-22979, the UI shows the code-entry field with the selected number kept; a code generated from a trusted device completes the login. ✅Fixes nab138/iloader#319